one isolated and standalone for tests
one with more privileged access for delivery

They should be on two Jenkins installations as with the new Jenkinsfile system, we can select the node, so if we want to run unprivileged users jobs on the CI, privileged jobs and CD must be elsewhere.